Facebook kept passwords in plain text logs
Hundreds of millions of passwords were readable in internal logs. Logs need the same care as databases.
Facebook confirmed last week that hundreds of millions of user passwords had been stored in plain text in internal logs, readable by employees, some for years. It says there’s no sign they were misused, and it will notify affected users.
Facebook hashed passwords properly in its database. The leak was in logging, where nobody looked.
This happens everywhere. Developers log whole requests to debug something, and the request contains a password, a card number or a token.
Check your own systems:
- Search your logs for words like password, token, secret and card.
- Filter sensitive fields in the logging library before they’re written.
- Limit access to logs and keep them only as long as needed.
- Review debug logging before it reaches production.
If you have a Facebook account, it doesn’t hurt to change the password and turn on two-factor authentication.